15.02.2023 | KPMG Law Insights

Critical infrastructure and investment control – caution in corporate transactions

Critical infrastructure and investment control – caution in corporate transactions

Anyone buying or selling shares in a company that operates critical infrastructure should be careful. This is because an investment control procedure may have to be carried out before the acquisition. Failure to do so may result in fines and imprisonment.

The background is: For decades, the global economy has grown together. However, a trend called decoupling has been emerging for several years. World powers are beginning to close off from each other, such as the U.S. and China. At the latest since the start of the war in Ukraine, there has been growing concern in Germany that important infrastructure will no longer be available.

To protect the population from a failure of this so-called critical infrastructure, the federal government has taken precautions. One of these is that services of general interest should remain within the EU.

For non-EU companies, this means that they cannot easily buy company shares in a critical infrastructure operator. If a buyer based outside the EU (or outside the EFTA area) wishes to acquire at least 10% of the voting rights in such a company, so-called investment control applies to protect public order and security. This means that the purchase of the shares must be reported in advance to the Federal Ministry of Economics and Climate Protection (BMWK). The BMWK examines the planned participation and approves it (if necessary, subject to conditions) or prohibits it.


How many companies fall under critical infrastructure is often underestimated

It is often underestimated how many company acquisitions now fall under the obligation to report to the BMWK. The German Federal Office for Information Security (BSIG) defines critical infrastructure in this way:

Critical infrastructures (CRITIS) are facilities, installations or parts thereof that belong to the sectors of

  • Energy
  • Information technology and telecommunications
  • Transportation and traffic
  • Health
  • Water
  • Nutrition
  • Finance and insurance or
  • Municipal waste management

and are of great importance to the functioning of the community because their failure or impairment would result in significant supply bottlenecks or threats to public safety.


Above a defined threshold, installations are considered critical

The reporting obligation does not apply to all companies in the sectors mentioned. This is only the case above certain thresholds. The basic rule for all sectors is that the plant must be capable of serving at least half a million people to be considered critical. The Ordinance on the Determination of Critical Infrastructures (BSI-KritisV) specifies when this is assumed in each case for each sector individually. For example, a food manufacturer is currently part of the critical infrastructure if it produces 434,500 tons of food or 350 million liters of beverages. For prescription drugs, the threshold is 4.65 million packages placed on the market per year. A normal generator is considered critical when it produces 104 megawatts of electricity. For certain energy suppliers, the threshold is even lower or non-existent.

Important: These thresholds are always adjusted. It was not until the beginning of 2022 that the thresholds were lowered significantly in some sectors.


Caution also in other industries and in restructurings

Even if at first glance the buyer belongs to an EU member state or the target company does not operate critical infrastructure, close scrutiny is required. This is because a number of other transactions may also be reportable under the German government’s Foreign Trade and Payments Ordinance (AWV). This includes the following constellations:

  • In addition to critical infrastructure, there are other industries where investments may be reportable. These are defined in § 55a para. 1 AWV listed. Examples of such industries include aerospace, media, and cybersecurity, as well as certain high technologies, such as robotics, quantum, nuclear, biotechnology, and artificial intelligence. The catalog was again significantly expanded with the AWV amendment in 2021.
  • Even intra-group restructurings can fall within the scope of investment control if the (intra-group) new acquiring company is a non-EU company.
  • Not only the initial investment, but also the increase of an existing investment may be reportable.
  • Cases are also conceivable in which the investment must be registered even though the acquirer is from the European Union. This may be the case if the acquirer itself has shareholders from non-EU member states.


Violations may result in fines and imprisonment

If the reporting requirement is overlooked and a transaction is completed, this can result in significant sanctions. These include, in particular, the invalidity of the underlying contract and its execution, heavy fines and even prison sentences of up to five years.


What should companies do?

It is not always easy for companies to determine whether a transaction needs to be reported. Mistakes, and thus penalties, lurk in many places. Complicating matters further is the fact that the conditions for mandatory reporting may well be changed at short notice and the thresholds for investment control further lowered, as has already happened in the recent past.

Companies from non-EU member states in particular are therefore well advised to have any acquisition of shares checked by a lawyer in advance.

Sufficient time should be allowed for the investment review. As a rule, the procedure at the BMWK takes two months. In individual cases, however, it can take up to eight months.

Explore #more

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…

14.02.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

09.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: The employment law function

In almost all German companies, the employment law function is located in the HR department and not in the legal department. One of the reasons…

02.02.2024 | KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

On December 14, 2023, the Council and the European Parliament reached a provisional political agreement on the EU Corporate Sustainability Due Diligence Directive (CSDDD). This…

01.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: Fair play in eSports

eSports is a billion-dollar market that is growing rapidly. This makes it all the more important for the economic players involved to comply with applicable…

24.01.2024 | KPMG Law Insights

How the new unitary patent works – ten facts

The new unitary patent can be applied for at the European Patent Office (EPO) from June 1, 2023. The Implementing Regulations and the Schedule of

22.01.2024 | PR Publications

Guest article in the Börsen-Zeitung on the subject of EU antitrust regulations

Agreements with competitors on sustainability efforts may violate antitrust law. Which legal interest should then take precedence? KPMG Law expert Jonas Brueckner discusses this question…

18.01.2024 | KPMG Law Insights

AI and copyright – what is permitted when using LLMs?

A few months ago, new players entered the legal scene and have since caused numerous legal discussions: Large Language Models (LLM), better known as…


Dr. Gerrit Rixen

Head of Antitrust and Merger Control

Barbarossaplatz 1a
50674 Köln

tel: +49 221 2716891052

Christoph Gröne

Senior Associate

Tersteegenstraße 19-23
40474 Düsseldorf

tel: 0211 4155597-763

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.